🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19477ee450732008d98e8ce55d7604ccb2184c684336f0af1685f3773377fab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19477ee450732008d98e8ce55d7604ccb2184c684336f0af1685f3773377fab2
SHA3-384 hash: ec1fb68f13cfce6c520832cb9c84c81953258b5b546137e5e6cb8b3ebcff5b68f877cdd208334a1e39b3a87c6ab89f46
SHA1 hash: beaff4aab417113b3c81732780a614a828f573eb
MD5 hash: 576bfc32e31c898cb2cfadf6ca1b09c5
humanhash: south-texas-one-bulldog
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'584 bytes
First seen:2026-06-19 02:30:36 UTC
Last seen:2026-06-19 04:41:35 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Uh6AlGD6Z5P6966oGp46pZynDbL6b1eaLBiaXI36G6376G6/p5O6khlk6RyE+t6o:sUfo2pUKp/SXVtx
TLSH T156316CDF50241A396212D9ED73733948A00CD4FB299BDBE48C484FAD868858CB261FC5
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/1e87een/an/aelf ua-wget
http://5.182.210.61/43d27an/an/aelf ua-wget
http://5.182.210.61/e15aecn/an/aelf ua-wget
http://5.182.210.61/458a82n/an/aelf ua-wget
http://5.182.210.61/fbc47an/an/aelf ua-wget
http://5.182.210.61/4433abn/an/aelf ua-wget
http://5.182.210.61/254ae3n/an/aelf ua-wget
http://5.182.210.61/302641n/an/aelf ua-wget
http://5.182.210.61/76afebn/an/aelf ua-wget
http://5.182.210.61/61673fn/an/aelf ua-wget
http://5.182.210.61/d1f642n/an/aelf ua-wget
http://5.182.210.61/c10abfn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a34a9d990632a45f72ba04b/reports/5beeb0cc-e7c8-4558-a685-aad3d8b02932/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-18T23:40:00Z UTC
Last seen:
2026-06-20T23:22:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/19477ee450732008d98e8ce55d7604ccb2184c684336f0af1685f3773377fab2/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d1d6f370-dec7-4159-9ea4-70cb33b937f2
Behavior Graph:
Download SVG
%3 guuid=2d744f06-1900-0000-dfc9-99cf73120000 pid=4723 /usr/bin/sudo guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732 /tmp/sample.bin guuid=2d744f06-1900-0000-dfc9-99cf73120000 pid=4723->guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732 execve guuid=45f1f608-1900-0000-dfc9-99cf7f120000 pid=4735 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=45f1f608-1900-0000-dfc9-99cf7f120000 pid=4735 execve guuid=3071e90d-1900-0000-dfc9-99cf93120000 pid=4755 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=3071e90d-1900-0000-dfc9-99cf93120000 pid=4755 execve guuid=b23fe616-1900-0000-dfc9-99cfb3120000 pid=4787 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=b23fe616-1900-0000-dfc9-99cfb3120000 pid=4787 execve guuid=d1e12a17-1900-0000-dfc9-99cfb5120000 pid=4789 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=d1e12a17-1900-0000-dfc9-99cfb5120000 pid=4789 clone guuid=00bb7517-1900-0000-dfc9-99cfb8120000 pid=4792 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=00bb7517-1900-0000-dfc9-99cfb8120000 pid=4792 execve guuid=ea37b517-1900-0000-dfc9-99cfba120000 pid=4794 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=ea37b517-1900-0000-dfc9-99cfba120000 pid=4794 execve guuid=3bfc0118-1900-0000-dfc9-99cfbc120000 pid=4796 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=3bfc0118-1900-0000-dfc9-99cfbc120000 pid=4796 execve guuid=60d6741a-1900-0000-dfc9-99cfc6120000 pid=4806 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=60d6741a-1900-0000-dfc9-99cfc6120000 pid=4806 execve guuid=a54a4421-1900-0000-dfc9-99cfe1120000 pid=4833 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=a54a4421-1900-0000-dfc9-99cfe1120000 pid=4833 execve guuid=d1e18921-1900-0000-dfc9-99cfe3120000 pid=4835 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=d1e18921-1900-0000-dfc9-99cfe3120000 pid=4835 clone guuid=2d7cc821-1900-0000-dfc9-99cfe6120000 pid=4838 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=2d7cc821-1900-0000-dfc9-99cfe6120000 pid=4838 execve guuid=c31f1d22-1900-0000-dfc9-99cfe8120000 pid=4840 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=c31f1d22-1900-0000-dfc9-99cfe8120000 pid=4840 execve guuid=7ab37822-1900-0000-dfc9-99cfea120000 pid=4842 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=7ab37822-1900-0000-dfc9-99cfea120000 pid=4842 execve guuid=aeb31f25-1900-0000-dfc9-99cff5120000 pid=4853 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=aeb31f25-1900-0000-dfc9-99cff5120000 pid=4853 execve guuid=66766f28-1900-0000-dfc9-99cf04130000 pid=4868 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=66766f28-1900-0000-dfc9-99cf04130000 pid=4868 execve guuid=6730bb28-1900-0000-dfc9-99cf07130000 pid=4871 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=6730bb28-1900-0000-dfc9-99cf07130000 pid=4871 clone guuid=1f61f428-1900-0000-dfc9-99cf0a130000 pid=4874 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=1f61f428-1900-0000-dfc9-99cf0a130000 pid=4874 execve guuid=7a884a29-1900-0000-dfc9-99cf0c130000 pid=4876 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=7a884a29-1900-0000-dfc9-99cf0c130000 pid=4876 execve guuid=6778a229-1900-0000-dfc9-99cf0e130000 pid=4878 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=6778a229-1900-0000-dfc9-99cf0e130000 pid=4878 execve guuid=d5b52c2c-1900-0000-dfc9-99cf19130000 pid=4889 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=d5b52c2c-1900-0000-dfc9-99cf19130000 pid=4889 execve guuid=bc62ef2f-1900-0000-dfc9-99cf28130000 pid=4904 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=bc62ef2f-1900-0000-dfc9-99cf28130000 pid=4904 execve guuid=2f784e30-1900-0000-dfc9-99cf2a130000 pid=4906 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=2f784e30-1900-0000-dfc9-99cf2a130000 pid=4906 clone guuid=1cd29730-1900-0000-dfc9-99cf2d130000 pid=4909 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=1cd29730-1900-0000-dfc9-99cf2d130000 pid=4909 execve guuid=c938f730-1900-0000-dfc9-99cf30130000 pid=4912 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=c938f730-1900-0000-dfc9-99cf30130000 pid=4912 execve guuid=f3af5231-1900-0000-dfc9-99cf32130000 pid=4914 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=f3af5231-1900-0000-dfc9-99cf32130000 pid=4914 execve guuid=a56fb133-1900-0000-dfc9-99cf3a130000 pid=4922 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=a56fb133-1900-0000-dfc9-99cf3a130000 pid=4922 execve guuid=c7708e37-1900-0000-dfc9-99cf43130000 pid=4931 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=c7708e37-1900-0000-dfc9-99cf43130000 pid=4931 execve guuid=7e65ea37-1900-0000-dfc9-99cf46130000 pid=4934 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=7e65ea37-1900-0000-dfc9-99cf46130000 pid=4934 clone guuid=1d523a38-1900-0000-dfc9-99cf49130000 pid=4937 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=1d523a38-1900-0000-dfc9-99cf49130000 pid=4937 execve guuid=6a219738-1900-0000-dfc9-99cf4c130000 pid=4940 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=6a219738-1900-0000-dfc9-99cf4c130000 pid=4940 execve guuid=1d39f538-1900-0000-dfc9-99cf4e130000 pid=4942 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=1d39f538-1900-0000-dfc9-99cf4e130000 pid=4942 execve guuid=6c95873b-1900-0000-dfc9-99cf59130000 pid=4953 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=6c95873b-1900-0000-dfc9-99cf59130000 pid=4953 execve guuid=cff5e240-1900-0000-dfc9-99cf6b130000 pid=4971 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=cff5e240-1900-0000-dfc9-99cf6b130000 pid=4971 execve guuid=04bc2941-1900-0000-dfc9-99cf6d130000 pid=4973 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=04bc2941-1900-0000-dfc9-99cf6d130000 pid=4973 clone guuid=15795e41-1900-0000-dfc9-99cf70130000 pid=4976 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=15795e41-1900-0000-dfc9-99cf70130000 pid=4976 execve guuid=436aab41-1900-0000-dfc9-99cf71130000 pid=4977 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=436aab41-1900-0000-dfc9-99cf71130000 pid=4977 execve guuid=8072f441-1900-0000-dfc9-99cf73130000 pid=4979 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=8072f441-1900-0000-dfc9-99cf73130000 pid=4979 execve guuid=a3479044-1900-0000-dfc9-99cf79130000 pid=4985 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=a3479044-1900-0000-dfc9-99cf79130000 pid=4985 execve guuid=7acc6b48-1900-0000-dfc9-99cf87130000 pid=4999 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=7acc6b48-1900-0000-dfc9-99cf87130000 pid=4999 execve guuid=8ac4ac48-1900-0000-dfc9-99cf8b130000 pid=5003 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=8ac4ac48-1900-0000-dfc9-99cf8b130000 pid=5003 clone guuid=5e58df48-1900-0000-dfc9-99cf8d130000 pid=5005 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=5e58df48-1900-0000-dfc9-99cf8d130000 pid=5005 execve guuid=b5f23d49-1900-0000-dfc9-99cf8f130000 pid=5007 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=b5f23d49-1900-0000-dfc9-99cf8f130000 pid=5007 execve guuid=98cd7949-1900-0000-dfc9-99cf91130000 pid=5009 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=98cd7949-1900-0000-dfc9-99cf91130000 pid=5009 execve guuid=210ec84b-1900-0000-dfc9-99cf99130000 pid=5017 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=210ec84b-1900-0000-dfc9-99cf99130000 pid=5017 execve guuid=e91f0b4f-1900-0000-dfc9-99cfaa130000 pid=5034 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=e91f0b4f-1900-0000-dfc9-99cfaa130000 pid=5034 execve guuid=e0d5504f-1900-0000-dfc9-99cfab130000 pid=5035 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=e0d5504f-1900-0000-dfc9-99cfab130000 pid=5035 clone guuid=f4da884f-1900-0000-dfc9-99cfae130000 pid=5038 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=f4da884f-1900-0000-dfc9-99cfae130000 pid=5038 execve guuid=8de6df4f-1900-0000-dfc9-99cfb1130000 pid=5041 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=8de6df4f-1900-0000-dfc9-99cfb1130000 pid=5041 execve guuid=a4232450-1900-0000-dfc9-99cfb3130000 pid=5043 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=a4232450-1900-0000-dfc9-99cfb3130000 pid=5043 execve guuid=05942853-1900-0000-dfc9-99cfc1130000 pid=5057 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=05942853-1900-0000-dfc9-99cfc1130000 pid=5057 execve guuid=c2df7d56-1900-0000-dfc9-99cfd2130000 pid=5074 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=c2df7d56-1900-0000-dfc9-99cfd2130000 pid=5074 execve guuid=f33cc456-1900-0000-dfc9-99cfd4130000 pid=5076 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=f33cc456-1900-0000-dfc9-99cfd4130000 pid=5076 clone guuid=052efc56-1900-0000-dfc9-99cfd7130000 pid=5079 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=052efc56-1900-0000-dfc9-99cfd7130000 pid=5079 execve guuid=de8c4357-1900-0000-dfc9-99cfdb130000 pid=5083 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=de8c4357-1900-0000-dfc9-99cfdb130000 pid=5083 execve guuid=eb9da157-1900-0000-dfc9-99cfdc130000 pid=5084 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=eb9da157-1900-0000-dfc9-99cfdc130000 pid=5084 execve guuid=3d4c955a-1900-0000-dfc9-99cfe1130000 pid=5089 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=3d4c955a-1900-0000-dfc9-99cfe1130000 pid=5089 execve guuid=d801fc5d-1900-0000-dfc9-99cfe9130000 pid=5097 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=d801fc5d-1900-0000-dfc9-99cfe9130000 pid=5097 execve guuid=24013d5e-1900-0000-dfc9-99cfeb130000 pid=5099 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=24013d5e-1900-0000-dfc9-99cfeb130000 pid=5099 clone guuid=5b45845e-1900-0000-dfc9-99cfed130000 pid=5101 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=5b45845e-1900-0000-dfc9-99cfed130000 pid=5101 execve guuid=1641ce5e-1900-0000-dfc9-99cfef130000 pid=5103 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=1641ce5e-1900-0000-dfc9-99cfef130000 pid=5103 execve guuid=60d2115f-1900-0000-dfc9-99cff1130000 pid=5105 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=60d2115f-1900-0000-dfc9-99cff1130000 pid=5105 execve guuid=cca37561-1900-0000-dfc9-99cff9130000 pid=5113 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=cca37561-1900-0000-dfc9-99cff9130000 pid=5113 execve guuid=37959865-1900-0000-dfc9-99cf05140000 pid=5125 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=37959865-1900-0000-dfc9-99cf05140000 pid=5125 execve guuid=b201e365-1900-0000-dfc9-99cf06140000 pid=5126 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=b201e365-1900-0000-dfc9-99cf06140000 pid=5126 clone guuid=f1fe2266-1900-0000-dfc9-99cf09140000 pid=5129 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=f1fe2266-1900-0000-dfc9-99cf09140000 pid=5129 execve guuid=2e1a7366-1900-0000-dfc9-99cf0b140000 pid=5131 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=2e1a7366-1900-0000-dfc9-99cf0b140000 pid=5131 execve guuid=17bab566-1900-0000-dfc9-99cf0d140000 pid=5133 /usr/bin/wget net send-data guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=17bab566-1900-0000-dfc9-99cf0d140000 pid=5133 execve guuid=71012a69-1900-0000-dfc9-99cf13140000 pid=5139 /usr/bin/curl net send-data write-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=71012a69-1900-0000-dfc9-99cf13140000 pid=5139 execve guuid=1d265d6c-1900-0000-dfc9-99cf1d140000 pid=5149 /usr/bin/chmod guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=1d265d6c-1900-0000-dfc9-99cf1d140000 pid=5149 execve guuid=6dc9ac6c-1900-0000-dfc9-99cf1f140000 pid=5151 /usr/bin/bash guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=6dc9ac6c-1900-0000-dfc9-99cf1f140000 pid=5151 clone guuid=6857f66c-1900-0000-dfc9-99cf21140000 pid=5153 /usr/bin/rm delete-file guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=6857f66c-1900-0000-dfc9-99cf21140000 pid=5153 execve guuid=a781536d-1900-0000-dfc9-99cf23140000 pid=5155 /usr/bin/rm guuid=f8623b08-1900-0000-dfc9-99cf7c120000 pid=4732->guuid=a781536d-1900-0000-dfc9-99cf23140000 pid=5155 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=45f1f608-1900-0000-dfc9-99cf7f120000 pid=4735->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=3071e90d-1900-0000-dfc9-99cf93120000 pid=4755->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=04eb4317-1900-0000-dfc9-99cfb6120000 pid=4790 /usr/bin/bash guuid=d1e12a17-1900-0000-dfc9-99cfb5120000 pid=4789->guuid=04eb4317-1900-0000-dfc9-99cfb6120000 pid=4790 clone guuid=3bfc0118-1900-0000-dfc9-99cfbc120000 pid=4796->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=60d6741a-1900-0000-dfc9-99cfc6120000 pid=4806->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=32c3a021-1900-0000-dfc9-99cfe4120000 pid=4836 /usr/bin/bash guuid=d1e18921-1900-0000-dfc9-99cfe3120000 pid=4835->guuid=32c3a021-1900-0000-dfc9-99cfe4120000 pid=4836 clone guuid=7ab37822-1900-0000-dfc9-99cfea120000 pid=4842->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=aeb31f25-1900-0000-dfc9-99cff5120000 pid=4853->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=f5edd028-1900-0000-dfc9-99cf08130000 pid=4872 /usr/bin/bash guuid=6730bb28-1900-0000-dfc9-99cf07130000 pid=4871->guuid=f5edd028-1900-0000-dfc9-99cf08130000 pid=4872 clone guuid=6778a229-1900-0000-dfc9-99cf0e130000 pid=4878->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=d5b52c2c-1900-0000-dfc9-99cf19130000 pid=4889->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=b4fb6b30-1900-0000-dfc9-99cf2c130000 pid=4908 /usr/bin/bash guuid=2f784e30-1900-0000-dfc9-99cf2a130000 pid=4906->guuid=b4fb6b30-1900-0000-dfc9-99cf2c130000 pid=4908 clone guuid=f3af5231-1900-0000-dfc9-99cf32130000 pid=4914->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a56fb133-1900-0000-dfc9-99cf3a130000 pid=4922->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=f8bf0938-1900-0000-dfc9-99cf48130000 pid=4936 /usr/bin/bash guuid=7e65ea37-1900-0000-dfc9-99cf46130000 pid=4934->guuid=f8bf0938-1900-0000-dfc9-99cf48130000 pid=4936 clone guuid=1d39f538-1900-0000-dfc9-99cf4e130000 pid=4942->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=6c95873b-1900-0000-dfc9-99cf59130000 pid=4953->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=00334241-1900-0000-dfc9-99cf6e130000 pid=4974 /usr/bin/bash guuid=04bc2941-1900-0000-dfc9-99cf6d130000 pid=4973->guuid=00334241-1900-0000-dfc9-99cf6e130000 pid=4974 clone guuid=8072f441-1900-0000-dfc9-99cf73130000 pid=4979->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a3479044-1900-0000-dfc9-99cf79130000 pid=4985->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d33cc148-1900-0000-dfc9-99cf8c130000 pid=5004 /usr/bin/bash guuid=8ac4ac48-1900-0000-dfc9-99cf8b130000 pid=5003->guuid=d33cc148-1900-0000-dfc9-99cf8c130000 pid=5004 clone guuid=98cd7949-1900-0000-dfc9-99cf91130000 pid=5009->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=210ec84b-1900-0000-dfc9-99cf99130000 pid=5017->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=69156a4f-1900-0000-dfc9-99cfac130000 pid=5036 /usr/bin/bash guuid=e0d5504f-1900-0000-dfc9-99cfab130000 pid=5035->guuid=69156a4f-1900-0000-dfc9-99cfac130000 pid=5036 clone guuid=a4232450-1900-0000-dfc9-99cfb3130000 pid=5043->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=05942853-1900-0000-dfc9-99cfc1130000 pid=5057->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=5b01dc56-1900-0000-dfc9-99cfd6130000 pid=5078 /usr/bin/bash guuid=f33cc456-1900-0000-dfc9-99cfd4130000 pid=5076->guuid=5b01dc56-1900-0000-dfc9-99cfd6130000 pid=5078 clone guuid=eb9da157-1900-0000-dfc9-99cfdc130000 pid=5084->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=3d4c955a-1900-0000-dfc9-99cfe1130000 pid=5089->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=441e575e-1900-0000-dfc9-99cfec130000 pid=5100 /usr/bin/bash guuid=24013d5e-1900-0000-dfc9-99cfeb130000 pid=5099->guuid=441e575e-1900-0000-dfc9-99cfec130000 pid=5100 clone guuid=60d2115f-1900-0000-dfc9-99cff1130000 pid=5105->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=cca37561-1900-0000-dfc9-99cff9130000 pid=5113->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=3b85fc65-1900-0000-dfc9-99cf07140000 pid=5127 /usr/bin/bash guuid=b201e365-1900-0000-dfc9-99cf06140000 pid=5126->guuid=3b85fc65-1900-0000-dfc9-99cf07140000 pid=5127 clone guuid=17bab566-1900-0000-dfc9-99cf0d140000 pid=5133->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=71012a69-1900-0000-dfc9-99cf13140000 pid=5139->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c414c56c-1900-0000-dfc9-99cf20140000 pid=5152 /usr/bin/bash guuid=6dc9ac6c-1900-0000-dfc9-99cf1f140000 pid=5151->guuid=c414c56c-1900-0000-dfc9-99cf20140000 pid=5152 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/19477ee450732008d98e8ce55d7604ccb2184c684336f0af1685f3773377fab2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19477ee450732008d98e8ce55d7604ccb2184c684336f0af1685f3773377fab2/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/19477ee450732008d98e8ce55d7604ccb2184c684336f0af1685f3773377fab2
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-19 02:31:38 UTC
File Type:
Text (Shell)
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dfdx5zcqomqarwmortsv25qezszbqtdiim3pblywqxzxom3x7kza._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260619-czleysey4v/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/19477ee450732008d98e8ce55d7604ccb2184c684336f0af1685f3773377fab2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 19477ee450732008d98e8ce55d7604ccb2184c684336f0af1685f3773377fab2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments